2013-10-22 15:53:08 -04:00
|
|
|
# encoding: utf-8
|
2019-04-29 20:27:42 -04:00
|
|
|
# frozen_string_literal: true
|
|
|
|
|
2022-07-27 22:27:38 -04:00
|
|
|
RSpec.describe ApiKey do
|
2019-05-06 23:12:20 -04:00
|
|
|
fab!(:user) { Fabricate(:user) }
|
2017-07-24 08:45:05 -04:00
|
|
|
|
2014-12-31 09:55:03 -05:00
|
|
|
it { is_expected.to belong_to :user }
|
|
|
|
it { is_expected.to belong_to :created_by }
|
2013-10-22 15:53:08 -04:00
|
|
|
|
2019-11-05 09:10:23 -05:00
|
|
|
it "generates a key when saving" do
|
2019-12-12 06:45:00 -05:00
|
|
|
api_key = ApiKey.new
|
|
|
|
api_key.save!
|
|
|
|
initial_key = api_key.key
|
2019-11-05 09:10:23 -05:00
|
|
|
expect(initial_key.length).to eq(64)
|
2017-07-24 08:45:05 -04:00
|
|
|
|
2019-11-05 09:10:23 -05:00
|
|
|
# Does not overwrite key when saving again
|
2019-12-12 06:45:00 -05:00
|
|
|
api_key.description = "My description here"
|
|
|
|
api_key.save!
|
|
|
|
expect(api_key.reload.key).to eq(initial_key)
|
|
|
|
end
|
|
|
|
|
|
|
|
it "does not have the key when loading later from the database" do
|
|
|
|
api_key = ApiKey.create!
|
|
|
|
expect(api_key.key_available?).to eq(true)
|
|
|
|
expect(api_key.key.length).to eq(64)
|
|
|
|
|
|
|
|
api_key = ApiKey.find(api_key.id)
|
|
|
|
expect(api_key.key_available?).to eq(false)
|
|
|
|
expect { api_key.key }.to raise_error(ApiKey::KeyAccessError)
|
|
|
|
end
|
|
|
|
|
|
|
|
it "can lookup keys based on their hash" do
|
|
|
|
key = ApiKey.create!.key
|
|
|
|
expect(ApiKey.with_key(key).length).to eq(1)
|
2019-11-05 09:10:23 -05:00
|
|
|
end
|
|
|
|
|
|
|
|
it "can calculate the epoch correctly" do
|
|
|
|
expect(ApiKey.last_used_epoch.to_datetime).to be_a(DateTime)
|
|
|
|
|
|
|
|
SiteSetting.api_key_last_used_epoch = ""
|
|
|
|
expect(ApiKey.last_used_epoch).to eq(nil)
|
|
|
|
end
|
|
|
|
|
|
|
|
it "can automatically revoke keys" do
|
|
|
|
now = Time.now
|
|
|
|
|
|
|
|
SiteSetting.api_key_last_used_epoch = now - 2.years
|
|
|
|
SiteSetting.revoke_api_keys_days = 180 # 6 months
|
|
|
|
|
|
|
|
freeze_time now - 1.year
|
|
|
|
never_used = Fabricate(:api_key)
|
|
|
|
used_previously = Fabricate(:api_key)
|
|
|
|
used_previously.update(last_used_at: Time.zone.now)
|
|
|
|
used_recently = Fabricate(:api_key)
|
|
|
|
|
|
|
|
freeze_time now - 3.months
|
|
|
|
used_recently.update(last_used_at: Time.zone.now)
|
|
|
|
|
|
|
|
freeze_time now
|
|
|
|
ApiKey.revoke_unused_keys!
|
|
|
|
|
|
|
|
[never_used, used_previously, used_recently].each(&:reload)
|
|
|
|
expect(never_used.revoked_at).to_not eq(nil)
|
|
|
|
expect(used_previously.revoked_at).to_not eq(nil)
|
|
|
|
expect(used_recently.revoked_at).to eq(nil)
|
|
|
|
|
|
|
|
# Restore them
|
|
|
|
[never_used, used_previously, used_recently].each { |a| a.update(revoked_at: nil) }
|
|
|
|
|
|
|
|
# Move the epoch to 1 month ago
|
|
|
|
SiteSetting.api_key_last_used_epoch = now - 1.month
|
|
|
|
ApiKey.revoke_unused_keys!
|
|
|
|
|
|
|
|
[never_used, used_previously, used_recently].each(&:reload)
|
|
|
|
expect(never_used.revoked_at).to eq(nil)
|
|
|
|
expect(used_previously.revoked_at).to eq(nil)
|
|
|
|
expect(used_recently.revoked_at).to eq(nil)
|
2013-10-22 15:53:08 -04:00
|
|
|
end
|
|
|
|
|
2020-07-16 14:51:24 -04:00
|
|
|
describe "API Key scope mappings" do
|
|
|
|
it "maps api_key permissions" do
|
|
|
|
api_key_mappings = ApiKeyScope.scope_mappings[:topics]
|
|
|
|
|
|
|
|
assert_responds_to(api_key_mappings.dig(:write, :actions))
|
|
|
|
assert_responds_to(api_key_mappings.dig(:read, :actions))
|
|
|
|
assert_responds_to(api_key_mappings.dig(:read_lists, :actions))
|
|
|
|
end
|
|
|
|
|
|
|
|
def assert_responds_to(mappings)
|
|
|
|
mappings.each do |m|
|
|
|
|
controller, method = m.split("#")
|
|
|
|
controller_name = "#{controller.capitalize}Controller"
|
|
|
|
expect(controller_name.constantize.method_defined?(method)).to eq(true)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
describe "#request_allowed?" do
|
2020-10-06 12:20:15 -04:00
|
|
|
let(:request) do
|
|
|
|
ActionDispatch::TestRequest.create.tap do |request|
|
|
|
|
request.path_parameters = { controller: "topics", action: "show", topic_id: "3" }
|
|
|
|
request.remote_addr = "133.45.67.99"
|
|
|
|
end
|
2023-01-09 06:18:21 -05:00
|
|
|
end
|
2020-10-06 12:20:15 -04:00
|
|
|
|
|
|
|
let(:env) { request.env }
|
|
|
|
|
2020-07-16 14:51:24 -04:00
|
|
|
let(:key) { ApiKey.new(api_key_scopes: [scope]) }
|
|
|
|
|
2021-11-10 10:48:00 -05:00
|
|
|
context "with regular scopes" do
|
|
|
|
let(:scope) do
|
|
|
|
ApiKeyScope.new(resource: "topics", action: "read", allowed_parameters: { topic_id: "3" })
|
|
|
|
end
|
2020-07-16 14:51:24 -04:00
|
|
|
|
2021-11-10 10:48:00 -05:00
|
|
|
it "allows the request if there are no allowed IPs" do
|
|
|
|
key.allowed_ips = nil
|
|
|
|
key.api_key_scopes = []
|
|
|
|
expect(key.request_allowed?(env)).to eq(true)
|
|
|
|
end
|
2020-07-16 14:51:24 -04:00
|
|
|
|
2021-11-10 10:48:00 -05:00
|
|
|
it "rejects the request if the IP is not allowed" do
|
|
|
|
key.allowed_ips = %w[115.65.76.87]
|
|
|
|
expect(key.request_allowed?(env)).to eq(false)
|
|
|
|
end
|
2020-07-16 14:51:24 -04:00
|
|
|
|
2021-11-10 10:48:00 -05:00
|
|
|
it "allow the request if there are not allowed params" do
|
|
|
|
scope.allowed_parameters = nil
|
|
|
|
expect(key.request_allowed?(env)).to eq(true)
|
|
|
|
end
|
2020-07-16 14:51:24 -04:00
|
|
|
|
2021-11-10 10:48:00 -05:00
|
|
|
it "rejects the request when params are different" do
|
|
|
|
request.path_parameters = { controller: "topics", action: "show", topic_id: "4" }
|
|
|
|
expect(key.request_allowed?(env)).to eq(false)
|
|
|
|
end
|
|
|
|
|
|
|
|
it "accepts the request if one of the parameters match" do
|
|
|
|
request.path_parameters = { controller: "topics", action: "show", topic_id: "4" }
|
|
|
|
scope.allowed_parameters = { topic_id: %w[3 4] }
|
|
|
|
expect(key.request_allowed?(env)).to eq(true)
|
|
|
|
end
|
|
|
|
|
|
|
|
it "allow the request when the scope has an alias" do
|
|
|
|
request.path_parameters = { controller: "topics", action: "show", id: "3" }
|
|
|
|
expect(key.request_allowed?(env)).to eq(true)
|
|
|
|
end
|
2020-07-16 14:51:24 -04:00
|
|
|
|
2021-11-10 10:48:00 -05:00
|
|
|
it "rejects the request when the main parameter and the alias are both used" do
|
|
|
|
request.path_parameters = { controller: "topics", action: "show", topic_id: "3", id: "3" }
|
|
|
|
expect(key.request_allowed?(env)).to eq(false)
|
|
|
|
end
|
2020-07-16 14:51:24 -04:00
|
|
|
end
|
|
|
|
|
2021-11-10 10:48:00 -05:00
|
|
|
context "with global:read scope" do
|
|
|
|
let(:scope) { ApiKeyScope.new(resource: "global", action: "read") }
|
|
|
|
|
|
|
|
it "allows only GET requests for global:read" do
|
|
|
|
request.request_method = "GET"
|
|
|
|
expect(key.request_allowed?(env)).to eq(true)
|
|
|
|
|
|
|
|
request.request_method = "POST"
|
|
|
|
expect(key.request_allowed?(env)).to eq(false)
|
|
|
|
end
|
2020-07-16 14:51:24 -04:00
|
|
|
end
|
|
|
|
end
|
2013-10-22 15:53:08 -04:00
|
|
|
end
|